Description

Detects IAM policies that combine wildcard resource specifications (*) with write/modify permissions, which could grant overly broad access to AWS resources. This represents a security risk by potentially allowing actions to be performed on unintended resources across the AWS account.

Detection Strategy

• Policy contains one or more statements that use a wildcard (*) in the Resource field

• The same statement grants write or modify permissions through Action or NotAction fields

• The statement has no Condition; statements granting * or service:* are reported regardless of conditions

• The policy is attached and active (using the default version of the policy)